PT-2009-4371 · Tinywebgallery+1 · Tinywebgallery+1

Egix · Published 2009-06-04 · Updated 2018-10-10 · CVE-2009-1911

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: QuiXplorer versions 2.3.2 and earlier TinyWebGallery (TWG) versions 1.7.6 and earlier

Description: The issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the lang parameter to the "admin/index.php" endpoint.

Recommendations: For QuiXplorer versions 2.3.2 and earlier, consider restricting access to the admin/index.php endpoint until a fix is available. For TinyWebGallery (TWG) versions 1.7.6 and earlier, avoid using the lang parameter in the admin/index.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-1911

Affected Products

Quixplorer

Tinywebgallery

References · 9

• 🔥 https://exploit-db.com/exploits/8649 · Exploit
• 🔥 http://securityfocus.com/bid/34892 · Exploit
• http://secunia.com/advisories/35020 · Vendor Advisory
• http://tinywebgallery.com/forum/viewtopic.php?t=1653 · Vendor Advisory
• http://secunia.com/advisories/35060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1911 · Security Note
• http://securityfocus.com/archive/1/503396/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50408 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1911 · Note